The Digital Personal Data Protection Bill, 2022, recently released by the Ministry of Electronics and Information Technology (MeitY), aims to establish a comprehensive framework for safeguarding personal data in India. The bill is a significant step in the right direction for India. The bill introduces several important changes to the way personal data is collected and processed in the country, including a definition of personal data that is broad enough to cover all types of personal information, a requirement for data fiduciaries to obtain consent from data principals before collecting or processing their personal data, a right for data principals to access, correct, and delete their personal data, a right for data principals to object to the processing of their personal data, and a requirement for data fiduciaries to report data breaches to the Data Protection Board of India (DPB).
While the bill represents a significant step forward, it also presents various shortcomings that must be addressed to ensure effective protection of citizens’ data and privacy.
The Need for Independence in the Regulatory Framework:
The proposed bill introduces the Data Protection Board of India (DPB) as the regulatory body. However, concerns arise regarding the board’s independence, given the central government’s influence in the appointment of officials and rule-making authority. To instil confidence in the data protection framework, it is crucial that the DPB operates independently, free from government interference.
Government’s Handling of Personal Data:
The bill includes exemptions allowing the government to process personal data without consent for law enforcement and national security purposes. While these exemptions may be justified, they grant the government excessive influence over citizens’ data, without explicit permission. It is essential to strike a balance that protects individual privacy rights while addressing legitimate concerns related to security and law enforcement.
Scrutiny of Significant Data Fiduciaries:
The bill introduces the concept of Significant Data Fiduciaries (SDFs), which are entities subject to additional obligations and scrutiny. However, the bill fails to automatically designate social media platforms that reach a certain user threshold as SDFs. This omission raises concerns regarding accountability and transparency for larger platforms, and it should be rectified to ensure comprehensive coverage.
Penalties and Compliance Burden:
The bill imposes severe penalties for violations, but the determination of the severity appears subjective. Ambiguity surrounding what constitutes “significant” noncompliance may deter individuals from exercising their rights due to fear of penalties. It is essential to provide clarity and specificity to foster a fair and effective enforcement mechanism.
Constitutional Analysis and Shortcomings:
Certain provisions of the bill raise constitutional concerns. Section 18, for instance, grants broad exemptions to state instrumentalities without adequate procedural protections. Furthermore, the absence of provisions for data portability and the right to be forgotten undermines crucial rights of data principals. Aligning the bill with constitutional principles of necessity, proportionality, and reasonableness is essential to protect individual privacy and data autonomy.
While the Digital Personal Data Protection Bill, 2022, represents a step towards protecting personal data, it requires refinement to address its shortcomings. Independent regulation, balanced government access to personal data, comprehensive coverage of significant entities, clear penalties, and robust constitutional safeguards are vital components that must be incorporated. Public consultations and stakeholder feedback should be carefully considered to develop a data protection legislation that strikes a balance between individual rights and the needs of a digital economy. By doing so, India can establish a robust framework that safeguards privacy, instills trust, and fosters innovation in the digital landscape.